The Summation-Truncation Hybrid: Reusing Discarded Bits for Free Aldo Gunsing and Bart Mennink Crypto 2020 1 / 14
PRP vs. PRF ◮ Many symmetric cryptographic schemes are based on pseudorandom permutations (PRPs) like AES 2 / 14
PRP vs. PRF ◮ Many symmetric cryptographic schemes are based on pseudorandom permutations (PRPs) like AES ◮ A lot of modes only use the forward direction, not making use of the invertibility 2 / 14
PRP vs. PRF ◮ Many symmetric cryptographic schemes are based on pseudorandom permutations (PRPs) like AES ◮ A lot of modes only use the forward direction, not making use of the invertibility ◮ In this case using a pseudorandom function (PRF) is often more secure 2 / 14
PRP vs. PRF ◮ Many symmetric cryptographic schemes are based on pseudorandom permutations (PRPs) like AES ◮ A lot of modes only use the forward direction, not making use of the invertibility ◮ In this case using a pseudorandom function (PRF) is often more secure ◮ Prominent example: CTR mode 0 1 2 0 1 2 P P P F F F x 0 x 1 x 2 x 0 x 1 x 2 y 0 y 1 y 2 y 0 y 1 y 2 n / 2-bit security n -bit-security 2 / 14
PRP-to-PRF Conversion ◮ We could design a dedicated PRF ◮ However, we have little understanding in how to design one 3 / 14
PRP-to-PRF Conversion ◮ We could design a dedicated PRF ◮ However, we have little understanding in how to design one ◮ Alternatively, we can design a PRP-to-PRF conversion 3 / 14
PRP-to-PRF Conversion ◮ We could design a dedicated PRF ◮ However, we have little understanding in how to design one ◮ Alternatively, we can design a PRP-to-PRF conversion ◮ PRP-PRF switch: PRP behaves like a PRF up to the birthday bound 3 / 14
PRP-to-PRF Conversion ◮ We could design a dedicated PRF ◮ However, we have little understanding in how to design one ◮ Alternatively, we can design a PRP-to-PRF conversion ◮ PRP-PRF switch: PRP behaves like a PRF up to the birthday bound ◮ Conversions like summation and truncation achieve beyond birthday bound security 3 / 14
Summation and Truncation x � 0 x � 1 P P y 4 / 14
Summation and Truncation x � 0 x � 1 P P y ◮ Sums two consecutive calls 4 / 14
Summation and Truncation x � 0 x � 1 P P y ◮ Sums two consecutive calls ◮ n -bit security 4 / 14
Summation and Truncation x x � 0 x � 1 n P P P a n − a y y ◮ Sums two consecutive calls ◮ n -bit security 4 / 14
Summation and Truncation x x � 0 x � 1 n P P P a n − a y y ◮ Sums two consecutive calls ◮ Truncates a call to the first a bits ◮ n -bit security 4 / 14
Summation and Truncation x x � 0 x � 1 n P P P a n − a y y ◮ Sums two consecutive calls ◮ Truncates a call to the first a bits ◮ Discards the other n − a bits ◮ n -bit security 4 / 14
Summation and Truncation x x � 0 x � 1 n P P P a n − a y y ◮ Sums two consecutive calls ◮ Truncates a call to the first a bits ◮ Discards the other n − a bits ◮ n -bit security ◮ Used in the key derivation function of GCM-SIV 4 / 14
Summation and Truncation x x � 0 x � 1 n P P P a n − a y y ◮ Sums two consecutive calls ◮ Truncates a call to the first a bits ◮ Discards the other n − a bits ◮ n -bit security ◮ Used in the key derivation function of GCM-SIV ◮ n − a / 2-bit security 4 / 14
Summation-Truncation Hybrid ◮ Instead of discarding bits, we can reuse them by applying summation 5 / 14
Summation-Truncation Hybrid x � 0 x � 1 ◮ Instead of discarding bits, we can reuse n n them by applying summation ◮ This leads to the Summation-Truncation P P Hybrid (STH) a n − a a n − a u v w 5 / 14
Summation-Truncation Hybrid x � 0 x � 1 ◮ Instead of discarding bits, we can reuse n n them by applying summation ◮ This leads to the Summation-Truncation P P Hybrid (STH) ◮ Outputs n − a extra bits compared to a n − a a n − a truncation u v w 5 / 14
Summation-Truncation Hybrid x � 0 x � 1 ◮ Instead of discarding bits, we can reuse n n them by applying summation ◮ This leads to the Summation-Truncation P P Hybrid (STH) ◮ Outputs n − a extra bits compared to a n − a a n − a truncation ◮ But we show that it has equal security! u v w 5 / 14
Summation-Truncation Hybrid x � 0 x � 1 ◮ Instead of discarding bits, we can reuse n n them by applying summation ◮ This leads to the Summation-Truncation P P Hybrid (STH) ◮ Outputs n − a extra bits compared to a n − a a n − a truncation ◮ But we show that it has equal security! ◮ Identical to summation when a = 0 u v w 5 / 14
Proof Sketch: Idea $ ← − Perm[ n ] P 0 1 P P u v w 6 / 14
Proof Sketch: Idea $ ← − Perm[ n ] P 0 1 P P u v w ◮ Try to separate the truncation and summation parts 6 / 14
Proof Sketch: Separating STH $ P ← − Perm[ n ] 0 1 0 1 P P P P u v u v w 7 / 14
Proof Sketch: Separating STH $ P ← − Perm[ n ] 0 1 0 1 P P P P u v u v w ◮ Just write the two parts separately 7 / 14
Proof Sketch: Separating STH $ P ← − Perm[ n ] 0 1 0 1 P P P P u v u v w ◮ Just write the two parts separately ◮ Problem: there is a shared secret P 7 / 14
Proof Sketch: Permutation-Separated STH $ $ P ′ ← − P ← − Perm[ n ] 0 1 0 1 P P P ′ P ′ u v u v w 8 / 14
Proof Sketch: Permutation-Separated STH $ $ P ′ ← − P ← − Perm[ n ] 0 1 0 1 P P P ′ P ′ u v u v w ◮ We re-choose the permutation, but keep the same distribution 8 / 14
Proof Sketch: Permutation-Separated STH $ $ P ′ ← − Perm comp ( u , v ) P ← − Perm[ n ] 0 1 0 1 P P P ′ P ′ u v u v w ◮ We re-choose the permutation, but keep the same distribution ◮ Perm comp ( u , v ) is the set of all permutations that give ( u , v ) as truncation output 8 / 14
Proof Sketch: Permutation-Separated STH $ $ P ′ ← − Perm comp ( u , v ) P ← − Perm[ n ] 0 1 0 1 P P P ′ P ′ u v u v w ◮ We re-choose the permutation, but keep the same distribution ◮ Perm comp ( u , v ) is the set of all permutations that give ( u , v ) as truncation output ◮ No shared secret, as u and v are public! 8 / 14
Proof Sketch: Isolating Truncation $ $ P ′ ← − Perm comp ( u , v ) P ← − Perm[ n ] 0 1 0 1 P P P ′ P ′ u v u v w 9 / 14
Proof Sketch: Isolating Truncation $ $ P ′ ← − Perm comp ( u , v ) P ← − Perm[ n ] 0 1 0 1 − { 0 , 1 } a $ ← u P P P ′ P ′ − { 0 , 1 } a $ ← v u v u v w ◮ Replace the truncation by a random function 9 / 14
Proof Sketch: Isolating Truncation $ $ P ′ ← − Perm comp ( u , v ) P ← − Perm[ n ] 0 1 0 1 − { 0 , 1 } a $ ← u P P P ′ P ′ − { 0 , 1 } a $ ← v u v u v w ◮ Replace the truncation by a random function ◮ Perm comp ( u , v ) still well-defined, although u and v are generated differently 9 / 14
Proof Sketch: Summation Modifications $ P ′ ← − Perm comp ( u , v ) 0 1 P ′ P ′ u v U V w = U ⊕ V 10 / 14
Proof Sketch: Summation Modifications $ P ′ ← − Perm comp ( u , v ) ◮ Modified summation with 0 1 subvalues U and V P ′ P ′ u v U V w = U ⊕ V 10 / 14
Proof Sketch: Summation Modifications $ P ′ ← − Perm comp ( u , v ) ◮ Modified summation with 0 1 subvalues U and V ◮ What are their distributions? P ′ P ′ u v U V w = U ⊕ V 10 / 14
Proof Sketch: Summation Modifications $ P ′ ← − Perm comp ( u , v ) ◮ Modified summation with 0 1 subvalues U and V ◮ What are their distributions? P ′ P ′ ◮ U has a uniform distribution u v U V w = U ⊕ V 10 / 14
Proof Sketch: Summation Modifications $ P ′ ← − Perm comp ( u , v ) ◮ Modified summation with 0 1 subvalues U and V ◮ What are their distributions? P ′ P ′ ◮ U has a uniform distribution ◮ For V it depends: u v ◮ If v � = u , V is uniform from { 0 , 1 } b U V ◮ If v = u , V is uniform from { 0 , 1 } b \ { U } w = U ⊕ V 10 / 14
Proof Sketch: Alternative Description $ P k ← − Perm[ b ] 0 1 P u P v U V w = U ⊕ V 11 / 14
Proof Sketch: Alternative Description $ P k ← − Perm[ b ] ◮ We modify the construction 0 1 to a family of permutations P u P v U V w = U ⊕ V 11 / 14
Proof Sketch: Alternative Description $ P k ← − Perm[ b ] ◮ We modify the construction 0 1 to a family of permutations ◮ We get the same distributions of U and V P u P v U V w = U ⊕ V 11 / 14
Proof Sketch: Alternative Description $ P k ← − Perm[ b ] ◮ We modify the construction 0 1 to a family of permutations ◮ We get the same distributions of U and V P u P v ◮ U has a uniform distribution U V w = U ⊕ V 11 / 14
Proof Sketch: Alternative Description $ P k ← − Perm[ b ] ◮ We modify the construction 0 1 to a family of permutations ◮ We get the same distributions of U and V P u P v ◮ U has a uniform distribution ◮ For V it depends: ◮ If v � = u , V is uniform from { 0 , 1 } b U V ◮ If v = u , V is uniform from { 0 , 1 } b \ { U } w = U ⊕ V 11 / 14
Recommend
More recommend
